gcdRadar
archive/Patch now/AIR-2025-0171
closedclosed 14 Mar 2025Patch now2 Disclosed vulnerabilityAI

Live API Keys Discovered in LLM Training Data Archive

Common Crawl, Azure OpenAI Service

Security researchers found thousands of live API keys and authentication credentials inside a web archive used for training large language models. The exposed secrets created risks for unauthorized access and downstream service compromises.

fix status
Fix status unknown
first report
28 Feb 2025
last update
28 Feb 2025

Timeline · 1

  1. 28 Feb 2025Alleged Inclusion of 12,000 Live API Keys in LLM Training Data Reportedly Poses Security Risks

Sources · 1

Research and catalogues

  1. 2025-02-28

Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.

Classification

AI role
Attack on AI
categories
Data leakSupply chain
severity
2 · Disclosed vulnerability
fix status
Fix status unknown
targets
OpenAI, Microsoft, Open-weight model
dates
happened 28 Feb 2025 · first reported 28 Feb 2025
origin
AI Incident Database
Derived from the AI Incident Database (CC BY-SA 4.0).
record
confidence 0.90 · created 2026-10-18 06:33Z · updated 2026-10-18 06:59Z

Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned

Copy a brief

This record as a short Markdown brief, for a ticket, a chat or a coding agent.

the brief as text
# Live API Keys Discovered in LLM Training Data Archive

https://gcdradar.vercel.app/incidents/live-api-keys-discovered-in-llm-training-data-archive · AIR-2025-0171 · closed 2025-03-14

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2025-02-28
- AI role: Attack on AI
- Products: Common Crawl, Azure OpenAI Service

## Summary

Security researchers found thousands of live API keys and authentication credentials inside a web archive used for training large language models. The exposed secrets created risks for unauthorized access and downstream service compromises.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-02-28: Alleged Inclusion of 12,000 Live API Keys in LLM Training Data Reportedly Poses Security Risks (https://incidentdatabase.ai/cite/956)

## Sources

- 2025-02-28 AI Incident Database: Alleged Inclusion of 12,000 Live API Keys in LLM Training Data Reportedly Poses Security Risks https://incidentdatabase.ai/cite/956

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.

Related

  1. closed
    AI
  2. closed
    AI
  3. closed
    AI
  4. closed
    LiteLLM LiteLLM Master Key Leak Leads to Malicious Package Release

    Supply chain · Exploited · since 24 Oct 2026 · updated 26 Oct 2026

    AI
  5. closed
    MCP servers & tools Postmark MCP Server Package Hijacked for Email Exfiltration

    Supply chain · Exploited · since Sep 2025 (approx.)

    AI
  6. closed8.2
    AI